[00:01.110 --> 00:01.810]  Thank you, guys.
[00:02.310 --> 00:08.230]  So really quick, before we start, I actually want to do a quick shout-out to our colleague Deji from Access Now as well.
[00:08.730 --> 00:10.350]  It's hosting a session that got moved.
[00:10.390 --> 00:14.870]  It's on how to fight an Internet shutdown, and it's now at 2 p.m. in Budapest, which is on the sixth floor.
[00:18.350 --> 00:21.070]  So good officially afternoon, everybody.
[00:21.090 --> 00:22.170]  It's now 12 o'clock.
[00:22.410 --> 00:23.770]  I hope you're doing well today.
[00:23.930 --> 00:25.050]  Thanks for joining us here at HOPE.
[00:25.970 --> 00:40.790]  We are from Access Now, which is a nonprofit organization that works globally with a mission to defend and extend the rights of users at risk, which means from about 10 different locations around the world, we work on issues involving policy, advocacy,
[00:40.830 --> 00:44.970]  and technology that directly impact the everyday person.
[00:45.850 --> 00:48.710]  And just to introduce ourselves, I'm going to introduce Amy very quickly.
[00:48.910 --> 00:49.770]  She's the U.S. Policy Manager and Global Policy Council at Access Now.
[00:53.110 --> 00:55.610]  We're going to get both into the U.S.
[00:55.750 --> 00:57.310]  policy and the global policy shortly.
[00:57.670 --> 01:09.270]  She was previously Director of Domestic Surveillance Project at Epic, and now serves on some boards, and she's a liaison to the American Bar Association's cybersecurity working group.
[01:09.370 --> 01:16.910]  I would argue that she's the world's leading expert on Hamilton, the musical, the intersection of Hamilton and crypto.
[01:17.190 --> 01:21.210]  So if you have any questions on the intersection of those two worlds, I think Amy is your person.
[01:23.110 --> 01:36.650]  So when I started Access Now, my supervisor at the time came to me and said, I can't tell you who to hire, but we have this intern who's the best intern we've ever had before in our entire organization's history, and we really think you should bring him on board.
[01:37.150 --> 01:44.050]  And that was Drew, and we ended up bringing him back on board as an intern, and now he is probably our most valued employee down in D.C. with me.
[01:44.430 --> 01:48.310]  He was previously the drummer in a rock band.
[01:49.130 --> 01:54.490]  He is now a policy counsel at Access Now working specifically on issues of cybersecurity.
[01:57.230 --> 02:02.510]  So, to start, I want everybody to hold your phone up in the air.
[02:03.090 --> 02:07.110]  Every cowboy sings a set, set song.
[02:07.450 --> 02:07.630]  I know.
[02:07.750 --> 02:09.310]  If you have more than one, just pick your favorite.
[02:09.590 --> 02:12.430]  Every rose has its thong.
[02:15.380 --> 02:15.860]  Great.
[02:16.140 --> 02:16.540]  Thank you.
[02:18.720 --> 02:30.860]  So, you can see we're kind of all part of one community, in that we all kind of know that there's an Internet, and there's a thing out there, and we can connect to people through it, which is wonderful.
[02:31.880 --> 02:36.100]  That community knows what the Internet is, and that's a really good start for this talk today.
[02:36.240 --> 02:38.240]  That's kind of the base of knowledge that you need.
[02:39.220 --> 02:45.500]  When you interact with people on the Internet, be it through messaging, banking, dating, something else.
[02:45.500 --> 02:46.440]  I don't want to know.
[02:46.920 --> 02:50.940]  Those interactions are probably, or at least they should be, protected by encryption.
[02:51.360 --> 02:58.820]  So, encryption in its simplest, most drilled down terms is the math that secures our digital interactions.
[02:59.820 --> 03:01.820]  And I know a lot of you out there already know this.
[03:02.000 --> 03:02.940]  Obviously, we're at HOPE.
[03:04.180 --> 03:10.380]  You guys are some of the most talented individuals when it comes to knowing issues about encryption, and computer science, and that kind of stuff.
[03:10.480 --> 03:17.820]  But don't run away, because we're going to start with the basics, just do a little review, and then we're going to get into kind of the heart of our presentation.
[03:19.640 --> 03:26.600]  But when you heard our bios, you were probably thinking of people who live here, our wonderful home field.
[03:26.980 --> 03:35.380]  It's the home of the techno-illiterate members of Congress and their staff, graying lobbyists, and a bunch of other people who don't really know what's going on in the world.
[03:35.380 --> 03:49.960]  But when we talk about encryption and the people who don't understand it, you may not know that we're also talking about people who live here, and here, and here, and here, and here, and here.
[03:50.560 --> 03:54.200]  And basically, all over the world.
[03:55.020 --> 04:00.120]  The inability to understand and appreciate encryption is a global phenomenon.
[04:00.120 --> 04:10.660]  And the battlefields that we're fighting that war on are continuing to grow, and encryption is continuing to be undermined and banned in many and growing places.
[04:11.520 --> 04:17.480]  And we need your help in these fights, if only to make sure that we don't end up in some weird, bad, dystopian future.
[04:18.000 --> 04:25.620]  You know, I really thought about including a picture from Donald Trump's acceptance speech last night, but I thought that might be a little bit too scary to start off the conference.
[04:25.740 --> 04:26.240]  A little political.
[04:26.800 --> 04:31.060]  So before we go into the future, let's just do a little review of the past.
[04:32.000 --> 04:40.860]  Encryption, which as we mentioned, is the art of concealing messages in code, has been around about as long as we've had communications between human beings.
[04:41.300 --> 04:47.640]  Julius Caesar famously used encryption to communicate in military matters, and he did so by shifting the letters of the alphabet.
[04:48.320 --> 04:52.220]  This technique is now known as the Caesar cipher in his honor.
[04:52.800 --> 05:01.960]  So if Caesar wanted to secretly communicate, Brutus is my homeboy, what he'd write is, you, you wix, uh, live, pib, cur, herb.
[05:03.880 --> 05:17.100]  If you want to get rich quick, on his death in 1730, famed pirate Olivier Levissois, my French is not good, probably hid his location of a great treasure with encrypted text, and that treasure has never been found.
[05:17.660 --> 05:20.320]  And thanks to Drew for teeing this one up for me.
[05:20.800 --> 05:30.340]  In the early 1800s, former Vice President Aaron Burr was tried for treason, and the key piece of evidence was actually an encrypted letter that he sent to General James Wilkinson.
[05:31.040 --> 05:36.120]  He had dictated that letter to his secretary, whose name was just Willie, think Madonna.
[05:36.960 --> 05:39.340]  His case was the first time a U.S. court ever confronted the question on encryption in the context of the U.S. Constitution.
[05:44.460 --> 05:46.800]  And you all may remember the most recent.
[05:49.660 --> 06:00.580]  Encryption was a key factor in World War II, as both sides simultaneously tried to hide their own activities while uncovering the others, while not letting the other side know that they had done so.
[06:01.040 --> 06:01.820]  When the U.S. and the U.K. broke the Enigma encryption, it marked kind of a turning point in the war.
[06:06.100 --> 06:09.220]  But it also marked the beginning of the age of modern computers.
[06:09.220 --> 06:12.520]  And computers have really changed the game on encryption.
[06:13.240 --> 06:18.520]  Today, anyone who gets on the Internet interacts with encryption daily and probably doesn't know it.
[06:18.740 --> 06:20.420]  Encryption today is more important than ever.
[06:20.600 --> 06:28.040]  So for everyday people like those on this slide, encryption is a silent bodyguard doing its best to keep unauthorized parties out of our digital lives.
[06:28.680 --> 06:37.180]  It's where we bank, where we email, chat, Snapchat, set up dates, call an Uber, buy movie tickets, all those things that we do on a daily basis.
[06:37.180 --> 06:40.400]  And it feels like everyday a new encrypted messaging app is launched.
[06:40.620 --> 06:45.140]  Or the messaging services that people already use are turning on encryption or providing the option.
[06:45.280 --> 06:50.000]  We just saw Facebook Messenger just enabled crypto by choice.
[06:50.360 --> 06:51.820]  But it's more than just messaging.
[06:52.040 --> 06:52.680]  Let's Encrypt.
[06:53.500 --> 06:58.960]  The Let's Encrypt project has already issued an impressive 5 million plus HTTPS certificates.
[06:58.960 --> 07:04.080]  So there's a much greater chance that now as you browse the Internet, you're doing it securely.
[07:05.160 --> 07:09.100]  And the tools are also improving to secure data on your smartphone that you held up earlier.
[07:09.400 --> 07:12.280]  The vast majority of iPhones are now encrypted by default.
[07:12.520 --> 07:19.140]  And while fewer Androids are encrypted, you know, I think that number will be improving in the near future.
[07:21.560 --> 07:29.980]  So three days from now when you're hungover, have your conference sleep schedule, you leave your phone on your chair out of delirium.
[07:30.440 --> 07:36.660]  These brilliant people walking around at HOPE are going to have a much more difficult time gaining access to that critical information on your phone.
[07:37.680 --> 07:47.260]  And for companies, encryption is not only a matter of protecting their intellectual property or their internal communications, it also protects the trust of their customers.
[07:47.820 --> 07:52.340]  And mostly crypto helps the helpers, the people we deal with on a daily basis.
[07:52.780 --> 07:56.360]  There's a reason that journalists and lawyers are frequently targeted for surveillance.
[07:56.720 --> 08:07.320]  They're in touch with some of the most vulnerable members of society and frequently don't have the technical background or know-how to know-how to protect their clients and their customers.
[08:07.800 --> 08:14.720]  If there is a duty on these institutions and the individuals, they really are not living up to that.
[08:16.020 --> 08:18.580]  But we know that crypto isn't perfect, right?
[08:18.700 --> 08:20.980]  I mean, we know it doesn't protect metadata, for example.
[08:22.960 --> 08:26.140]  There's a lot of personal information still floating around in the ether.
[08:26.600 --> 08:31.980]  It can't protect against many methods of hacking, password loss, normal human error.
[08:32.580 --> 08:41.280]  And lots of technologies have vulnerabilities that allow the sophisticated actors and sometimes the not-so-sophisticated ones, you know who you are, to route around the protection.
[08:41.520 --> 08:45.220]  So, for all shortcomings, encryption is still one of the best tools we've got.
[08:45.560 --> 08:50.860]  And some people, particularly those people we mentioned earlier in DC, still haven't figured that out.
[08:51.920 --> 08:53.600]  So yeah, that's all really depressing.
[08:54.220 --> 08:56.360]  Let's take a cute break for just a second.
[08:58.120 --> 08:59.500]  Aww, it's a tiger.
[09:00.200 --> 09:00.780]  All right.
[09:01.920 --> 09:05.520]  You may have heard about the ongoing fights over encryption in the United States.
[09:05.700 --> 09:12.720]  And when I say ongoing, I kind of mean on and on and on and on and on and on, all the way back to the 1970s.
[09:13.460 --> 09:16.840]  Back then, the encryption fights were about what are known as export controls.
[09:18.300 --> 09:34.520]  The U.S. was far ahead in the race to develop encryption at the time, and the people in DC thought that they could keep other people from accessing encryption that was too strong, that is, encryption that the NSA couldn't break, as long as they prohibited it from being sent outside the country.
[09:35.000 --> 09:39.560]  And to many people then, that sounds as crazy as it probably sounds to all of you now.
[09:40.280 --> 09:42.860]  And you might know this piece of technology.
[09:42.860 --> 09:51.400]  This is the Clipper chip, which the NSA developed in order to create a key escrow system with distributed keys.
[09:51.720 --> 09:57.860]  It was promoted as a method of ensuring government access while maintaining security against other attacks.
[09:58.100 --> 10:03.340]  And the proposal actually gained significant support in the Clinton administration as a way to preserve surveillance capabilities.
[10:04.320 --> 10:06.960]  But we overcame the attacks on crypto.
[10:07.360 --> 10:17.260]  In 1994, Matt Blaze, who is speaking on encryption actually this evening, wrote the paper that helped tear down the Clipper chip, with a little help from his friends.
[10:17.700 --> 10:20.520]  And in 1995, the Ninth Circuit in Bernstein v. U.S. ruled that speech, that source code is speech, protected by the First Amendment, leading to an easing on the encryption controls.
[10:29.700 --> 10:34.440]  So the Clipper chip is a relic and probably a very, you know, valuable relic.
[10:34.680 --> 10:40.320]  And export controls are largely rolled back, though there are still some on the books.
[10:41.180 --> 10:42.900]  But now we're going dark.
[10:43.460 --> 10:54.320]  So the FBI most recently threw the director, James Comey, has continuously gotten up in front of Congress and said, there's some amount of data that law enforcement cannot access because it's encrypted.
[10:55.180 --> 10:58.360]  Let's digress for a second to recognize the misleading nature of the claim.
[10:58.360 --> 11:05.060]  So while the FBI raises the going dark alarm for the better part of the decade, in reality we're in a golden age of surveillance.
[11:05.480 --> 11:10.500]  Never has there been so much data about people's personal lives so readily available.
[11:10.860 --> 11:17.440]  So when you talk about how encryption impacts this picture, it's probably less like this and more like this.
[11:18.740 --> 11:32.040]  But regardless, the outcome of the increased number of adversaries looking to compromise user information and the growing recognition of the importance of crypto is that companies are working overtime to make their encryption better, stronger, and more resilient.
[11:32.440 --> 11:40.320]  Today, most crypto is so strong that attempts to brute force it using the technology we have available would take at least until the heat death of the universe.
[11:41.300 --> 11:52.300]  One of the strongest forms of crypto available now ensures that only the people with the keys can actually access that information, or if it's a device, with the owner of the device.
[11:52.960 --> 12:01.020]  So this is the type of encryption being implemented in iMessage, WhatsApp, Silent Circle, all the messaging apps that many people have now adopted.
[12:01.020 --> 12:06.400]  There are cases where the FBI have reported that they are having trouble getting to evidence.
[12:07.220 --> 12:13.420]  So, Director Comey got in front of Congress, issued and urged them to respond to this problem.
[12:13.740 --> 12:25.480]  One legislative proposal that we've seen was introduced by a representative named McCall, a Republican from Texas, and a Democratic Senator from Warner, Warner from Virginia, rather.
[12:25.660 --> 12:30.200]  And it wants to establish a commission to study the problem of encryption, quote-unquote.
[12:30.200 --> 12:37.000]  So, it's not so bad, especially when compared to the nightmare-inducing Burr-Feinstein proposal.
[12:37.280 --> 12:46.080]  So, named for its sponsors, the eminent Senators Richard Burr from North Carolina and Dianne Feinstein from California, in case you happen to vote in either of those states.
[12:46.300 --> 12:49.200]  Richard Burr's up for election this year, if you're in North Carolina.
[12:50.460 --> 12:58.960]  The legislation not only requires companies maintain access to unencrypted text that it controls, but if the company operates an app store, e.g.
[12:59.040 --> 13:05.360]  Apple, Google, they would also have to ensure access to data that operates through the apps in that app store.
[13:06.260 --> 13:09.000]  So, that catches you up to where the conversation in the U.S. is.
[13:09.440 --> 13:13.420]  But these policy debates are taking place all over the world, and that's where we started.
[13:14.020 --> 13:29.420]  The problem is that once one government starts discussing a topic or a problem or anything, really, what we see over and over and over again is that other governments and other world leaders decide that that is the topic that they want to talk about as well.
[13:29.820 --> 13:32.460]  So, an example of this is mandatory data retention.
[13:32.740 --> 13:37.840]  It started kind of being discussed in just a few countries, and now we're seeing it everywhere.
[13:37.840 --> 13:46.080]  From Latin America, Southeast Asia, the MENA region, all of these countries are trying to implement mandatory data retention proposals if they haven't done so already.
[13:47.220 --> 13:50.140]  It's kind of part of what we call the surveillance arms race.
[13:50.700 --> 13:52.380]  And that's what's happening on encryption.
[13:52.980 --> 13:57.740]  And the ideas that we're seeing pop up range from ineffective to outright harmful.
[13:58.260 --> 14:00.100]  They would undermine global Internet security.
[14:00.520 --> 14:02.540]  Actually, they kind of just undermine security.
[14:03.340 --> 14:06.960]  And there are about three broad categories that we're going to talk about.
[14:07.660 --> 14:10.000]  And different approaches within each category.
[14:10.980 --> 14:13.960]  Yeah, and these aren't specific to any particular region.
[14:14.140 --> 14:15.960]  We're really seeing a global response.
[14:16.100 --> 14:22.220]  And for us tracking these proposals, it's fairly difficult to keep up with just the pace of proposals.
[14:22.400 --> 14:25.740]  But the first type we're going to look at are countries looking to outlaw crypto.
[14:26.040 --> 14:29.440]  So, for the most part, this includes end-to-end or device encryption.
[14:29.760 --> 14:33.220]  And we're seeing this in places in Russia, China, Rwanda.
[14:34.360 --> 14:39.340]  China and Rwanda maintain that providers must be able to turn over information upon request.
[14:39.860 --> 14:41.920]  Russia, though, takes a slightly different approach.
[14:42.180 --> 14:54.480]  A law that just passed earlier this month would require that some companies, although we don't know which ones, have to turn over encryption keys to the government, specifically to the security forces.
[14:55.060 --> 14:57.780]  Penalties for disobeying these laws can often be extreme.
[14:58.240 --> 15:04.640]  There's no upper limit on the fine, for example, in China that can be levied on a company that violates this by failing to turn over the keys.
[15:05.440 --> 15:12.800]  There's even a law in Colombia which, thankfully, knock on wood, hasn't been enforced, but it totally bans encryption by use for the public.
[15:12.800 --> 15:23.040]  And so, the only people in Colombia that would be able to use crypto if the law had been enforced were members of high-ranking government officials.
[15:24.900 --> 15:33.860]  The second broad category is the more traditional backdoor that I'm sure you've heard discussed over and over again, or at least we've heard discussed over and over again.
[15:34.980 --> 15:44.420]  This is most recently in the headlines, actually, in the United Kingdom, in the UK's Investigatory Powers Bill that is currently making its way through the parliament.
[15:44.420 --> 15:47.280]  It's in the House of Lords, and we're expecting it to pass imminently.
[15:47.620 --> 15:50.880]  It was championed by their new prime minister, Theresa May.
[15:53.200 --> 16:05.080]  Earl Howell, a minister for the state, for the defense in the UK, explained, and I'm going to quote, I was certainly not implying that the government wishes to ban end-to-end encryption.
[16:05.360 --> 16:08.920]  In fact, we do not seek to ban any kind of encryption.
[16:09.380 --> 16:19.940]  However, there will be circumstances where it is reasonably practicable for a company to build in a facility to decrypt the contents of communications.
[16:21.160 --> 16:23.300]  He thought that this was going to be reassuring.
[16:23.640 --> 16:26.380]  I can tell you it is definitely not reassuring.
[16:27.620 --> 16:46.640]  And oddly enough, two countries you rarely hear discussed at the same time, but this is eerily similar to a proposal that we've seen in Kazakhstan, where they reportedly require users to install and download what are called... to download and install what are called national security certificates.
[16:48.400 --> 16:55.460]  It seems that these allow providers to intercept and decrypt otherwise encrypted information straight from the device.
[16:56.660 --> 17:01.060]  Kazakh Telecom published a notice about this technology on its website.
[17:01.860 --> 17:05.840]  And the New York Times caught ahold of it and called them up and was like, WTF.
[17:06.960 --> 17:10.580]  And they pulled the notice down, but they didn't really say what's going on.
[17:10.640 --> 17:20.340]  So the problem is, is we don't really know the status of that proposal right now, other than at last check, these devices were going... these certificates were going to be required to be downloaded.
[17:22.300 --> 17:28.580]  So the final category we'll talk about is just kind of a grab bag, which is governments are finding any way they can to respond.
[17:29.000 --> 17:39.780]  So for example, in Brazil, you might have heard that they imprisoned a senior executive from Facebook after WhatsApp implemented end-to-win encryption for the messaging service.
[17:40.560 --> 17:43.460]  The company was obviously not able to hand over the data.
[17:43.460 --> 17:54.240]  Just this past week, earlier this week, we saw a Brazilian court order WhatsApp shut down because WhatsApp was not able to, again, provide data that was end-to-win encrypted.
[17:54.880 --> 18:02.800]  Thankfully, that was overturned, but WhatsApp is widely used in Brazil, so to shut down the service for the entire country obviously impacts millions of people.
[18:03.820 --> 18:14.160]  So taking up a similar banner, France can also consider a law that would enable the arrest of company officials for not handing over unencrypted content.
[18:14.740 --> 18:17.120]  Thankfully, that policy was disregarded.
[18:18.120 --> 18:29.800]  Another approach that we saw in India, again, thankfully disregarded but considered, would have allowed companies to encrypt, but would have required that they store a plain text copy of whatever the encrypted communication was.
[18:30.060 --> 18:31.580]  So obviously very useful.
[18:32.960 --> 18:36.880]  A new policy is expected to be released soon in India.
[18:37.060 --> 18:39.180]  Hopefully it will be something different.
[18:40.080 --> 18:42.020]  But that's a quick snapshot.
[18:42.020 --> 18:45.200]  But I think we're in need for another cute break after that.
[18:49.650 --> 18:50.730]  Wait for it.
[18:59.600 --> 19:04.780]  So what our world leaders don't realize is that encryption is not a problem.
[19:04.780 --> 19:06.600]  Encryption is actually the solution.
[19:07.040 --> 19:10.220]  So we've discussed some of the benefits provided by encryption.
[19:10.800 --> 19:21.320]  Encryption tools, technologies, and services are essential to protect and shield those from harm, and to make sure our communications aren't accessed without authorization.
[19:21.760 --> 19:28.080]  The ability to freely develop and use encryption protects and provides the cornerstone for today's global economy.
[19:28.780 --> 19:38.460]  And economic growth is really powered by the ability to trust and to authenticate our interactions and communicate and conduct business security, both within and across borders.
[19:39.360 --> 19:55.940]  Some of our most noted technologists and experts on encryption recently explained that laws or policies that undermine encryption, and I'm quoting here again, force a U-turn from the best practices now deployed to make the Internet more secure, substantially increase system complexity,
[19:56.280 --> 20:00.260]  and create concentrated targets that could attract bad actors.
[20:00.260 --> 20:04.340]  And that's from the keys under doormats report that Matt Blaze will report on later today.
[20:04.900 --> 20:12.520]  The absence of encryption, by comparison, facilitates easy access to sensitive data, including financial and identity information.
[20:13.260 --> 20:20.320]  And once obtained, that sensitive data can be sold, posted, used for blackmail, used to embarrass somebody.
[20:20.740 --> 20:23.360]  The uses for it kind of go on and on and on.
[20:23.360 --> 20:27.660]  And in addition, insufficiently encrypted devices are really prime targets for theft.
[20:28.840 --> 20:42.200]  So, despite all these benefits, we've been keeping a keen eye out for positive government responses to crypto, and there are disappointingly few governments that have stood up in favor of crypto.
[20:42.200 --> 20:48.480]  So, in January of this year, the Netherlands led the way by releasing this statement in support of encryption.
[20:48.480 --> 20:53.940]  This is from the Ministry of Security and Justice, and it specifically recognized the importance of encryption.
[20:54.100 --> 21:05.260]  So, it says, encryption supports the respect of personal privacy and confidential communications of citizens because it offers that means to protect the confidentiality and integrity of personal data and communication.
[21:05.380 --> 21:06.600]  A little bit redundant, but still important.
[21:06.600 --> 21:20.540]  They talked about freedom of expression, the importance of protecting journalists to a democratic society, and most importantly, this is a quote, endorse the importance of strong encryption for Internet security to support the protection of personal privacy of citizens.
[21:20.760 --> 21:26.120]  So, this is probably the strongest statement that we have on record, or one of the strongest in support of crypto.
[21:26.840 --> 21:29.140]  Slightly less good, this is also out of Europe.
[21:29.140 --> 21:39.660]  This is from ANISA, which is the EU agency that does network and information security, jointly with Europol, in which they trumpeted the importance of encryption.
[21:40.060 --> 21:54.100]  Ultimately, unfortunately, hedged on the recommendation, but they said, when circumvention is not possible, yet access to encrypted information is imperative for justice and security, then feasible solutions to decryption without weakening the protective mechanisms must be offered,
[21:54.100 --> 21:57.380]  both in legislation and through continuous technical evolution.
[21:58.060 --> 22:05.980]  So, if you guys don't know what that is code for, is they want to authorize government hacking, which is kind of the next step of this communication, or of this conversation.
[22:06.600 --> 22:12.780]  And what you're going to see, I think, over the rest of this year and throughout next year, pop up within Congress.
[22:13.160 --> 22:18.860]  Although, really, that's amazing, because it's what the FBI, it's what the NSA and the U.S.
[22:18.940 --> 22:25.040]  have been doing since the 1990s, and we've never talked about it, and it's never been authorized, and there are no safeguards in place for it.
[22:26.000 --> 22:35.100]  So, the fact that we're finally starting to recognize that encryption is going to be... we have to assume encryption, and then what comes next?
[22:35.420 --> 22:42.140]  We shouldn't assume that government hacking is a great thing, but the fact that we're engaging in that conversation is really a significant step forward.
[22:44.560 --> 22:49.220]  And as we said earlier, Director Comey and the FBI and the U.S., you know, the U.S.
[22:49.300 --> 22:54.920]  is not great on encryption, and they have really pushed hard against the strong... the implementation of strong encryption.
[22:55.240 --> 22:58.700]  But outside of law enforcement agencies, there have been bright spots.
[22:59.860 --> 23:09.240]  President Obama's comments on the subject have not been everything we would want them to be, but he has continually recognized the importance that encryption plays in our digital lives.
[23:10.620 --> 23:24.660]  Earlier this year, I don't know if you've saw... you've seen this website before, but AccessNow, with our friends and partners at the Electronic Frontier Foundation, launched SaveCrypto.org, which was a petition that used the President's own API at We the People,
[23:25.600 --> 23:28.760]  and we called on him to inequivocally support strong encryption.
[23:29.320 --> 23:43.660]  A little bit about We the People, if you don't know, it is a website or basically a service that the White House put out in order to allow people to more directly exercise their First Amendment right to petition the government.
[23:43.980 --> 23:51.860]  And the White House has promised to provide a response to any petition that reaches a certain threshold of signatures within a certain period of time.
[23:53.620 --> 24:03.340]  After really justified complaints about how long they were taking to respond to these petitions, they also promised to do their best to provide a substantive response within 60 days.
[24:04.160 --> 24:08.580]  So the current threshold there is 100,000 signatures within 30 days.
[24:08.860 --> 24:15.000]  And SaveCrypto.org not only met that threshold, but far surpassed it, did really well, got a lot of support.
[24:16.180 --> 24:28.680]  And unfortunately, however, the White House, though they have twice responded to the petition, and their response has basically been, we need you to provide us more information on encryption, because even though we've been talking about this since the 1970s,
[24:28.840 --> 24:30.740]  we don't know enough about it yet.
[24:31.100 --> 24:33.380]  But they haven't substantively responded.
[24:33.580 --> 24:47.900]  So you can see that we have on the website now a count up of how many days since we reached that threshold without a response, and we're going to continue pressuring the White House to provide a response, because there really are only, what, it's July,
[24:48.240 --> 24:51.100]  August, September, there are only a few months left in the administration.
[24:51.100 --> 24:52.900]  He doesn't have a lot of time to do that.
[24:53.040 --> 24:53.380]  Yeah.
[24:53.420 --> 24:56.440]  And that's just, that's a couple days old, so it's already, I think, 270 now.
[24:56.580 --> 25:03.100]  But let's hope that we get a response from Obama before any potential worse administrations feel obligated to respond to this issue.
[25:03.780 --> 25:05.100]  But before, so...
[25:05.100 --> 25:05.980]  Not mentioning any names.
[25:05.980 --> 25:07.040]  Yeah, not mentioning names.
[25:07.200 --> 25:08.880]  But we haven't, so we obviously haven't won yet.
[25:09.120 --> 25:13.340]  And if it wasn't abundantly clear, we alluded to San Bernardino earlier.
[25:13.980 --> 25:20.060]  In case you don't remember, this was where the two terrorists were responsible for a number of deaths in San Bernardino.
[25:20.060 --> 25:25.440]  One of them left behind an iPhone that was owned by the city of San Bernardino, where he'd been employed.
[25:26.040 --> 25:30.240]  Two other personal devices that he owned had been physically destroyed.
[25:31.420 --> 25:43.920]  The iPhone had full-disk encryption enabled, and it was protected by two specific security measures, which were a numeric passcode and a limitation on the number of times that that passcode could be guessed.
[25:44.020 --> 25:47.280]  So brute forcing it was, there was a barrier to brute forcing it.
[25:47.280 --> 25:52.780]  And the FBI wanted to access the phone to see if there was any information on it that would be necessary to the investigation.
[25:52.820 --> 25:58.660]  So there's the possibility of an iCloud backup to the information that had been stored on that device.
[25:58.660 --> 26:02.940]  But the FBI foreclosed the possibility of gaining access to the iCloud backup.
[26:03.600 --> 26:16.980]  So they decided the only option was to compel Apple under a law called the All Ritz Act to build a new operating system that would bypass the security features that were vital to the full-disk encryption.
[26:16.980 --> 26:21.280]  So ultimately, they didn't actually need to use the All Ritz Act to compel.
[26:21.400 --> 26:28.040]  They actually purchased an exploit from a third party that enabled them to bypass the crypto.
[26:28.260 --> 26:31.520]  So the court had approved the FBI's request.
[26:31.780 --> 26:33.620]  Apple moved to challenge the approval.
[26:33.920 --> 26:36.280]  There was a significant public outcry.
[26:37.160 --> 26:41.080]  And so we submitted an amicus brief.
[26:41.120 --> 26:44.120]  I know a number of other organizations and individuals did as well.
[26:44.360 --> 26:50.440]  We think it's very likely that this was the most brief submitted to a magistrate judge ever before.
[26:50.600 --> 26:53.140]  But that's just our suspicion.
[26:56.900 --> 27:00.460]  And let me get right to it before I start talking about our amicus brief.
[27:00.700 --> 27:04.900]  Because ultimately, the FBI did get access to the phone.
[27:05.300 --> 27:08.580]  And the tagline of the story was, you know, they said they absolutely had to get access.
[27:08.740 --> 27:10.540]  There was critical information on the phone.
[27:10.880 --> 27:12.700]  Dormant cyber pathogens were at issue.
[27:13.180 --> 27:14.320]  Their words, not mine.
[27:16.540 --> 27:19.240]  And everybody kind of looked at them and kind of cocked their head a little bit.
[27:19.320 --> 27:20.580]  And we're like, what are you talking about?
[27:20.760 --> 27:22.580]  And we were kind of right.
[27:22.580 --> 27:25.200]  Ultimately, they discovered nothing of interest on the phone.
[27:25.600 --> 27:28.200]  Although in the FBI's true...
[27:29.260 --> 27:33.560]  What they tend to do when they discover no evidence is they say, we discovered evidence.
[27:33.560 --> 27:35.400]  We discovered evidence that there was no evidence.
[27:36.600 --> 27:38.400]  And that was vital for us to know.
[27:38.720 --> 27:40.600]  And so that was how that whole played out.
[27:40.980 --> 27:45.820]  But Access Now, along with the Wicker Foundation, actually submitted an amicus brief in this case.
[27:46.660 --> 27:47.420]  Very proud.
[27:47.420 --> 27:50.020]  We were the first group to submit an amicus brief.
[27:52.460 --> 27:57.200]  And we specifically discussed human rights law and the importance of encryption to users.
[27:57.900 --> 28:01.920]  Encryption and anonymity are essential to our ability to express ourselves.
[28:02.160 --> 28:06.880]  So without it, activists, journalists, people around the world, people in this room are at greater risk of exploitation.
[28:08.060 --> 28:18.260]  At Access Now, we know this because we operate a digital security helpline that provides direct technical assistance to users at risk and members of civil society all over the world.
[28:18.260 --> 28:24.040]  In the brief, we raised some of the cases where data insecurity put real people at risk of significant harm.
[28:24.500 --> 28:31.000]  In one case, a blogger was arrested in Southeast Asia after the government compromised their unsecured iPhone.
[28:31.780 --> 28:40.560]  And in another, our helpline advised South African activists on how to communicate securely when they were under threat of their personal information leaking ahead of a protest.
[28:41.260 --> 28:44.980]  These cases and others highlight why encryption is so important for human rights.
[28:45.280 --> 28:47.960]  But you don't really have to take my word for it because who am I?
[28:48.820 --> 28:59.980]  In 2015, a report by the UN Special Rapporteur for Freedom of Expression, David Kaye, he explained that encryption and anonymity are essential to the free exercise of the right to free speech and privacy.
[28:59.980 --> 29:06.340]  And while we know this, it's really, really hard to report on the benefits of encryption.
[29:06.940 --> 29:14.660]  Partly because it's hard to prove a negative and partly because encryption works best when you don't know that it's there and when it operates seamlessly in the background.
[29:14.660 --> 29:17.100]  So you have to be more imaginative to see its value.
[29:18.360 --> 29:25.120]  It could be that you crossed an international border and the border agents asked to access your phone and they couldn't get a hold of it.
[29:25.320 --> 29:30.580]  Or sometimes they force themselves into it, as we saw in the last couple days.
[29:31.520 --> 29:39.440]  Maybe it could be because you visited a research website and your authentication credentials were encrypted because it used HTTPS.
[29:40.460 --> 29:45.600]  Users around the world need encryption to be able to communicate, travel, organize, and live their lives.
[29:46.840 --> 29:54.200]  LGBT individuals in the Middle East and North Africa use encryption tools to seek support, protecting themselves from government persecution.
[29:55.020 --> 30:00.800]  By contrast, one of the most heartbreaking stories on where encryption might have been helpful.
[30:01.080 --> 30:06.260]  A citizen journalist in Mexico was murdered after her cell phone was compromised.
[30:06.660 --> 30:12.680]  And when they were able to get into her cell phone, they noticed that she had been running a Twitter account that had been reporting on cartel activity.
[30:13.840 --> 30:18.780]  And the cartels were really, really against reports on that activity.
[30:19.000 --> 30:22.260]  And they not only murdered her, but they live tweeted her murder from her own account.
[30:23.080 --> 30:30.140]  Encryption might not have prevented that from happening, but it sure could have provided her a degree of control over her ultimate fate.
[30:30.140 --> 30:42.200]  So recognizing that crypto is a global issue, that bad policies in one place can have significant impacts other places, AccessNow coordinated securetheinternet.org.
[30:42.200 --> 30:53.480]  So this was a coalition of 185 different groups from 65 different countries that speak a number of different languages, companies, and other experts, users.
[30:53.480 --> 30:59.860]  We all spoke together with the voice, and we made five specific points to government leaders.
[30:59.980 --> 31:01.820]  We sent this letter to a number of leaders.
[31:02.380 --> 31:11.700]  The points were, one, government should not ban or otherwise limit user access to encryption in any form or otherwise prohibit the implementation or use of encryption by grade or type.
[31:12.280 --> 31:18.540]  Two, government should not mandate the design or implementation of backdoors or vulnerabilities into tools, technologies, or services.
[31:18.540 --> 31:28.300]  Three, government should not require that tools, technologies, or services are designed or developed to allow for third-party access to unencrypted data or encryption keys.
[31:28.900 --> 31:38.280]  Four, government should not seek to weaken or undermine encryption standards or intentionally influence the establishment of encryption standards, except to promote a higher level of information security.
[31:38.560 --> 31:43.420]  No government should mandate insecure encryption algorithms, standards, tools, or technologies.
[31:43.420 --> 31:53.620]  And finally, five, government should not, either by private or public agreement, compel or pressure an entity to engage in activity that is inconsistent with the above tenets.
[31:53.880 --> 32:01.760]  So, now, as these battles around the world on encryption continue to grow and multiply, there's a countervailing force.
[32:02.300 --> 32:08.460]  Already, we have forced response in Australia, where there are discussions about pushing forward an encryption proposal.
[32:08.460 --> 32:16.100]  So, together, we can push back other harmful proposals and mandates and move to a more secure and encrypted Internet future.
[32:18.580 --> 32:20.000]  Thank you all for joining us.
[32:20.140 --> 32:21.920]  And we'd love to take your questions, if you have any.
[32:31.740 --> 32:33.100]  First of all, let me say thanks.
[32:33.300 --> 32:35.960]  It's super fantastic to get just, like, that lay of the land.
[32:36.560 --> 32:43.380]  I think what I really want is, like, the next hour talk about what the conversation around legalized government hacking looks like, right?
[32:43.500 --> 32:48.460]  Like, that's where this goes, the lowest cost access to information looks like that.
[32:48.560 --> 32:53.780]  I'm curious what you think, like, what's the top-line takeaway for you for that conversation here in the states?
[32:54.080 --> 32:58.120]  Like, what would you start doing tomorrow morning about that stuff, right?
[32:58.600 --> 33:13.160]  I love that question, because in two weeks, actually, Access Now is hoping, two or three weeks, to put out a report on government hacking, and specifically its interaction with human rights and how it, if it complies with human rights law and standards around the world.
[33:13.500 --> 33:16.160]  So, we're basically right now digging into that question.
[33:16.340 --> 33:18.840]  And I think that that is really a preliminary question.
[33:19.060 --> 33:22.720]  Is government hacking even possible in line with international law?
[33:23.320 --> 33:28.640]  And I think the answer, like, spoiler, is most of the times, no.
[33:29.620 --> 33:38.980]  And maybe in some cases, but there have to be extreme safeguards, including a lot of transparency and accountability measures put into place.
[33:39.720 --> 33:47.340]  So, I think we need to start with when it should be banned outright, and then talk about how extreme the safeguards can be on the back end.
[33:48.140 --> 33:50.320]  Oh, I'll just add very quickly before you ask your follow-up.
[33:51.820 --> 33:57.880]  Whereas encryption, there's some established body of law, maybe, or some policy on point.
[33:59.040 --> 34:00.940]  Hacking, there's significantly less.
[34:01.060 --> 34:08.920]  So, it requires some creativity in thinking about how it's actually been used, what are the implications, and then following that, what are the policies?
[34:09.100 --> 34:16.840]  And so, without the presidential policies on point, it requires some level of creativity to think about what safeguards should be put in place.
[34:17.420 --> 34:17.740]  Awesome.
[34:17.920 --> 34:18.900]  I'll keep my eyes peeled then.
[34:19.020 --> 34:19.180]  Thanks.
[34:19.320 --> 34:19.500]  Thanks.
[34:21.440 --> 34:21.940]  Hey there.
[34:22.120 --> 34:22.980]  My name's Brady Dale.
[34:23.160 --> 34:24.940]  I'm a tech reporter based here in New York.
[34:25.160 --> 34:36.060]  And one of the things I'm starting to get a little, starting to suspect, and I wonder if you guys can speak to this, if it's something that you've seen, is it seems like there was a story last week, or it just came out yesterday, about a journalist at the L.A.
[34:36.160 --> 34:41.680]  airport who was asked to turn over her phones, and she refused, and they ultimately let her go and didn't ask her for it.
[34:41.680 --> 34:58.880]  But I sort of feel like a few of the other stories I've seen of, like, the FBI asking big companies for data about users sort of follows a similar line of inquiry where it seems like sometimes government operatives ask for things they don't have the authority to ask for because you can always ask.
[34:59.520 --> 35:03.040]  It's assuming people will think they have the authority to ask for it, and so then they'll give it to them.
[35:03.480 --> 35:08.400]  And then sometimes some companies say, like, we'll show us where the authority comes from to do that, and they're like, oh, whoops, we don't have it.
[35:08.560 --> 35:19.020]  But is that a thing that you guys are observing is, you know, agencies asking for things that they don't actually have a legal right to ask for, but they're just asking because they think people might give it to them anyway?
[35:20.700 --> 35:25.340]  Oftentimes they're asking for what they think they can ask for or what they interpret that they can ask for.
[35:25.480 --> 35:27.340]  You know, intelligence agencies in the U.S.
[35:27.360 --> 35:30.420]  and everywhere want to push their authority to its outer boundaries.
[35:30.580 --> 35:31.620]  They want as much as possible.
[35:32.740 --> 35:42.140]  Drew and I actually wrote an implementation guide for what are called, this is a mouthful, the International Principles on the Application of Human Rights to Communication Surveillance.
[35:42.140 --> 35:50.320]  And one of the things that we said and that I think is really good advice for people who own companies is that they need to challenge these orders always.
[35:50.920 --> 35:59.940]  Because you never know when there is a faulty interpretation of law or that they're trying to kind of sneak one of these requests in that pushes the outer boundaries.
[36:00.160 --> 36:07.560]  And so we think that that challenge is really necessary and to make sure that a court is really digging into this and looking at it.
[36:09.840 --> 36:12.480]  These approvals happen ex parte most of the time.
[36:13.100 --> 36:14.520]  There's nobody else in the room.
[36:14.780 --> 36:16.640]  The user definitely doesn't know about it.
[36:16.720 --> 36:23.880]  And it really falls on the company to make sure that some degree of rights are protected or at least examined in the approval process.
[36:24.180 --> 36:32.800]  Yeah, and I think if you look at the way that the Department of Justice used the All Writs Act, you know, they said we have a valid search warrant.
[36:32.800 --> 36:36.360]  And so we're trying to force Apple to comply with it.
[36:36.540 --> 36:43.800]  And forcing them to comply, though, involved an entire universe of potential things that Apple could do, right?
[36:43.900 --> 36:47.500]  So there was not really much under the case that the DOJ was arguing.
[36:47.620 --> 36:50.600]  There's not really much limit on what they could actually get out of Apple.
[36:50.600 --> 36:57.360]  And so I think there potentially is... that's outside of maybe the, like, informal request that maybe you're specifically talking about.
[36:57.440 --> 37:05.280]  But even under a formal request under the All Writs Act, there's potentially a significant amount of leeway that the government is arguing that it has access to.
[37:05.420 --> 37:09.080]  I think the things that it can do to compel companies to comply with its orders.
[37:13.260 --> 37:24.220]  I've mostly heard most of the current arguments being about danger to life and being arrested, things like that.
[37:24.760 --> 37:38.320]  Maybe you can comment on some of the effects that some of these proposed laws might have to financial records or what effect it might have on SOX compliance or PCI, HIPAA.
[37:39.600 --> 37:40.200]  Yeah.
[37:40.700 --> 37:41.100]  Go ahead.
[37:41.300 --> 37:52.680]  You know, these are the same crypto systems that deal with messaging and device storage are implemented on things like financial systems, right?
[37:52.740 --> 37:53.400]  And health systems.
[37:53.640 --> 38:05.060]  And so, you know, that's one of the things that we certainly have argued is that if you're talking about requiring a backdoor in crypto, it's certainly not going to be just limited to devices or communications.
[38:05.060 --> 38:11.720]  it's going to impact financial systems, health systems, kind of the world of systems that require critical protections.
[38:12.220 --> 38:25.240]  This is... these proposals are actually, I think, really amping up how much knowledge people have to have, including medical professionals who are trying to protect health data under HIPAA, lawyers who have a duty of confidentiality to their clients.
[38:25.240 --> 38:33.180]  Can those people buy technologies from countries that have implemented encryption mandates?
[38:33.620 --> 38:34.580]  Probably not.
[38:34.820 --> 38:46.880]  And if the U.S. follows suit, like, to what extent is it outside of those duties of care to purchase technologies implemented or produced within that jurisdiction?
[38:46.880 --> 38:49.000]  Can you produce... can you buy U.S. technology?
[38:49.320 --> 38:55.460]  And certainly one of the arguments being made in D.C. is that this is going to kill the U.S. tech industry.
[38:56.140 --> 39:05.960]  People will have to outsource to where they can actually create adequate security within their systems that people trust and that doesn't have backdoors.
[39:06.720 --> 39:07.360]  Right.
[39:07.680 --> 39:24.940]  So, as far as the proposed laws that you mentioned in England, how might that affect the safe harbor problems that we're having communicating with European countries?
[39:26.040 --> 39:27.540]  And storing their data?
[39:27.540 --> 39:27.860]  Yeah.
[39:29.500 --> 39:31.720]  It probably won't impact that conversation.
[39:32.020 --> 39:42.440]  What it's more likely to impact is there is currently a proposal that we just got draft language on a week ago, Friday evening at about 7 p.m.
[39:42.500 --> 39:55.820]  because that's when DOJ drops things that they don't really want you to pay attention to, where the UK wants direct access under its own laws to wiretap and to go to companies in the United States and get data.
[39:55.820 --> 39:57.640]  And it requires a change of U.S. law.
[39:58.200 --> 40:00.780]  But it will be under UK legal standards.
[40:01.420 --> 40:12.120]  And so, unfortunately, the UK, which already has very lax standards for access to data, are making those standards even worse in a lot of cases.
[40:12.760 --> 40:15.300]  They are wanting encryption backdoors.
[40:15.660 --> 40:18.480]  They want to allow bulk hacking.
[40:18.480 --> 40:26.300]  I don't even know what bulk hacking would mean because their regular hacking provisions can impact thousands and millions of people.
[40:26.520 --> 40:29.720]  So if you have that under regular hacking, I don't know what you're doing under bulk hacking.
[40:30.940 --> 40:41.420]  And so I think that is the proposal that I'm hoping will come under threat from the UK, especially now that the UK isn't part of the EU or imminently won't be part of the EU.
[40:41.420 --> 40:45.440]  I don't think that it will interact with the privacy shield negotiations.
[40:46.060 --> 40:46.500]  Thanks.
[40:49.660 --> 40:50.100]  Hi.
[40:50.660 --> 40:51.820]  Just a couple of things.
[40:53.340 --> 40:57.280]  In your intro, you talked about the Enigma, which I think was originally broken by the polls.
[40:58.400 --> 40:58.840]  Fair.
[41:00.520 --> 41:04.820]  And then a lot of the crypto, the bulk surveillance crypto stuff...
[41:05.360 --> 41:08.700]  In England, I get the impression that really what they're trying to do is construct...
[41:09.260 --> 41:11.320]  Well, my term is a risk-free society.
[41:11.980 --> 41:14.920]  So if they can see it coming, then they can mitigate.
[41:16.380 --> 41:21.000]  But what I think we need to do is add a small cost to the decryption.
[41:21.580 --> 41:25.160]  That way, it's not economical to do it all, and you have to focus your efforts.
[41:25.760 --> 41:33.220]  And if you go back 50 years, really that's what any surveillance had to do.
[41:33.340 --> 41:39.760]  You had to concentrate on the targets of interest, as opposed to simply decrypt it all, figure it all out ahead of time.
[41:41.100 --> 41:47.160]  Are you seeing any of that focus or lack of focus from where you are?
[41:48.780 --> 41:54.580]  So we actually were looking at that question two and a half years ago in the U.S.
[41:54.840 --> 41:56.780]  under the NSA's bulk surveillance programs.
[41:57.180 --> 42:01.120]  And how encryption interacted with that bulk surveillance.
[42:01.960 --> 42:08.160]  And what we started to see, and actually what we started to push for, was increased encryption exactly for what you're saying.
[42:08.640 --> 42:15.060]  To try to overcome that collected all mentality and push for more targeted surveillance.
[42:15.820 --> 42:19.980]  Because I don't think that anybody I know would say that no surveillance should take place.
[42:20.060 --> 42:21.760]  Or maybe a few people I know would say that.
[42:23.280 --> 42:28.900]  But it should be the people who actually need to have surveillance on them conducted and not everybody.
[42:29.400 --> 42:32.240]  And definitely not a lot of the people that for some reason the U.S.
[42:32.320 --> 42:34.600]  government thinks it should be collecting information on.
[42:34.600 --> 42:41.300]  So we see encryption as at least a limit on the bulk surveillance that people can conduct.
[42:41.520 --> 42:43.520]  The U.S., the U.K., anybody.
[42:43.960 --> 42:48.100]  And so that push has definitely been something that has been in active conversations.
[42:48.860 --> 42:55.840]  And the U.K., you know, the U.K.'s system, legal system for these orders is fairly different from the U.S. system, right?
[42:57.220 --> 43:02.580]  So in the U.K. they're thinking about things like they have to justify an order under necessity and proportionality, which are human rights language.
[43:02.580 --> 43:09.340]  The problem is that when you consider bulk surveillance necessary and proportionate, then it's not really a safeguard.
[43:09.580 --> 43:13.740]  And so we've already seen that under the existing surveillance authorities in the U.K.
[43:14.160 --> 43:18.860]  And there's no real reason to think that that's going to be different under the expanded authorities, right?
[43:20.200 --> 43:20.660]  Thank you.
[43:20.960 --> 43:21.100]  Yeah.
[43:24.570 --> 43:24.990]  Hi.
[43:25.190 --> 43:25.930]  Thanks for coming.
[43:26.250 --> 43:27.070]  My name's Devin.
[43:27.270 --> 43:29.350]  I'm an attorney in private practice here in the city.
[43:29.590 --> 43:31.510]  And I'm trying to...
[43:31.510 --> 43:35.870]  I work at a small firm, and I'm trying to get my firm to adopt more use of encryption.
[43:37.450 --> 43:37.870]  Thanks.
[43:38.770 --> 43:40.690]  I'm running into some challenges.
[43:42.730 --> 43:48.990]  First is that in order to do public key encryption, not only do the senior partners need to adopt it, but also clients.
[43:49.390 --> 43:53.130]  And I'm not sure which is the bigger challenge, but they're both issues.
[43:53.130 --> 43:58.710]  And I haven't seen any resource that really tackles that head on or has a proposed solution.
[43:58.830 --> 43:59.970]  I'm curious your thoughts on that.
[43:59.970 --> 44:12.930]  The other is a really good, simple file encryption, where you're not just using Windows to put a password on a file, but something that really encrypts it that's an easy, simple program to use, or writings about both those things.
[44:13.170 --> 44:13.390]  Thanks.
[44:13.910 --> 44:14.030]  Yeah.
[44:14.270 --> 44:15.350]  I know that the...
[44:15.350 --> 44:24.050]  I think it's the New York City Bar Association has been considering how to help facilitate crypto for local firms.
[44:24.270 --> 44:25.270]  I don't know what that...
[44:25.270 --> 44:31.210]  Our colleague, actually, Peter Mysek, has been part of those discussions because he's based in New York City.
[44:31.370 --> 44:33.830]  And so, you know, I think that's...
[44:33.830 --> 44:38.870]  I think it's at least something that is more now becoming a recognition that attorney...
[44:38.870 --> 44:39.990]  It's a critical tool for attorneys, right?
[44:40.070 --> 44:45.310]  So, I mean, you know, something like Signal is easy to point to because it takes no effort to actually implement crypto.
[44:45.310 --> 44:49.590]  But to get clients to use PGP is obviously going to be a more significant challenge.
[44:49.850 --> 44:50.690]  And this is like...
[44:50.690 --> 44:51.670]  Encryption is hard.
[44:52.450 --> 44:54.010]  Like PGP is really hard.
[44:54.010 --> 44:55.250]  I have people...
[44:55.250 --> 44:57.310]  People we work with mess it up on occasion.
[44:57.890 --> 44:59.250]  Everybody messes it up on occasion.
[45:00.030 --> 45:03.790]  The problem is that you really want to incentivize people to develop encryption.
[45:03.950 --> 45:08.850]  End-to-end strong, by default, encryption in ways that work for people.
[45:09.110 --> 45:15.770]  You're not doing that by arresting executives of companies who implement end-to-end encryption.
[45:16.130 --> 45:19.110]  So, these laws actually are having a backward impact.
[45:19.110 --> 45:27.330]  Do these proposals having a backward impact on the ability of people to develop encryption, like what senior partners might be able to implement?
[45:28.450 --> 45:33.730]  We would love to see things like Signal or WhatsApp actually implemented on email.
[45:34.030 --> 45:36.170]  And I know that there are a lot of companies who are trying to do that.
[45:36.250 --> 45:38.010]  That easy end-to-end email encryption.
[45:39.410 --> 45:41.070]  There are options out there.
[45:41.070 --> 45:43.970]  I think on our website, we point to a lot of different solutions.
[45:44.230 --> 45:46.070]  There's also street...
[45:47.290 --> 45:49.590]  Oh, I'm going to mess up the EFF project.
[45:49.750 --> 45:52.810]  And then people in this room, I know that you're out there and you're all going to kill me.
[45:54.650 --> 45:55.370]  It's SSL.
[45:55.650 --> 45:57.490]  So, I think it's SSL.EFF.org.
[45:57.630 --> 45:59.890]  If you go to EFF site, they also have a lot of resources.
[46:00.330 --> 46:00.690]  SS...
[46:01.250 --> 46:01.950]  Thank you!
[46:03.190 --> 46:04.450]  SSD.EFF.org.
[46:05.170 --> 46:06.990]  And they have a lot of tools there as well.
[46:07.150 --> 46:09.170]  So, you can look at the toolkits that are available.
[46:10.410 --> 46:11.290]  Thank you very much.
[46:11.430 --> 46:11.630]  Thanks.
[46:13.250 --> 46:16.050]  Mine's quick and easy and probably doesn't involve anybody.
[46:16.530 --> 46:17.910]  Do you have...
[46:17.910 --> 46:19.010]  Do you speak in the microphone?
[46:19.470 --> 46:28.270]  Have you had the opportunity to have ongoing discussions or would you want ongoing discussions with the FCC about some of these issues?
[46:29.130 --> 46:31.810]  The FCC is starting, I believe, to look at encryption.
[46:32.750 --> 46:35.010]  We're trying to figure out the best ways to interact.
[46:35.130 --> 46:36.690]  We work with a lot of different agencies.
[46:37.330 --> 46:42.690]  The FTC, I think, just brought their first few complaints on companies not implementing encryption.
[46:42.910 --> 46:47.510]  So, would you like help just being able to do basically this presentation to the eighth floor?
[46:48.690 --> 46:50.430]  I'm just offering like an in.
[46:51.230 --> 46:52.290]  Can you say that again?
[46:52.630 --> 46:52.850]  Yeah.
[46:53.090 --> 46:53.250]  Sure.
[46:53.330 --> 46:53.470]  Yeah.
[46:53.550 --> 46:55.870]  I'll say also on the FCC that they've...
[46:55.870 --> 46:56.830]  Oh, you're with us.
[46:56.950 --> 46:57.070]  That's great.
[46:57.870 --> 47:02.570]  I will say that on the recent broadband privacy proposal, there are...
[47:02.570 --> 47:06.610]  There's requirements in there for comp telcos to take security measures, right?
[47:06.710 --> 47:07.770]  So, I think encryption is part of that.
[47:07.870 --> 47:09.470]  It would be great to...
[47:09.470 --> 47:13.470]  And the chairman is right now really favorable.
[47:13.930 --> 47:17.050]  And so, if you guys want to just call in, I can help...
[47:17.510 --> 47:17.950]  Yeah.
[47:18.230 --> 47:19.910]  If you're going to be around after this, can we chat?
[47:19.910 --> 47:19.930]  What?
[47:20.690 --> 47:21.390]  Are you...
[47:21.390 --> 47:21.950]  Go find my son.
[47:22.250 --> 47:22.470]  Okay.
[47:22.670 --> 47:24.270]  We'll be here all weekend also.
[47:24.490 --> 47:24.850]  I'll find you.
[47:24.870 --> 47:25.130]  Great.
[47:25.230 --> 47:25.530]  Awesome.
[47:25.750 --> 47:28.010]  Thank you.
[47:28.590 --> 47:28.870]  Thank you.
[47:29.110 --> 47:29.510]  Great.
[47:30.450 --> 47:30.890]  Hey, how you doing?
[47:30.990 --> 47:31.170]  Hi.
[47:31.370 --> 47:34.130]  I had a couple questions slash comments.
[47:34.330 --> 47:35.110]  And one of the things...
[47:35.110 --> 47:51.790]  I'd never heard of your organization prior to this, but one of the things I didn't hear you talk about is do you, in your work, address the illusion of security promulgated by algorithms that aren't being updated in proportion to the increase in computing power?
[47:52.050 --> 47:57.690]  Because some of this stuff is like the equivalent of seat belts made out of toilet paper.
[47:57.910 --> 48:07.830]  I mean, like you talk about TLS, for example, and they're still using RSA keys that aren't the same strength as the underlying encryption.
[48:08.710 --> 48:10.810]  So I guess that would be my first question.
[48:12.410 --> 48:13.670]  I don't know if you want me to...
[48:13.670 --> 48:16.930]  You want to answer and then ask another one or do you want me to give you all of them at once?
[48:17.690 --> 48:18.550]  How many are there?
[48:18.970 --> 48:19.590]  Just two.
[48:19.910 --> 48:20.130]  Okay.
[48:20.330 --> 48:21.130]  Let's do one at a time.
[48:22.150 --> 48:30.250]  So we definitely look at these from like the snake oil salesman perspective in that a lot of apps that came out are just awful.
[48:31.010 --> 48:35.750]  And they try to sell exactly what you said, the illusion of security, but with no security at all.
[48:36.270 --> 48:38.110]  So we do analyze it from that perspective.
[48:38.310 --> 48:48.110]  From the other side of it, we tend to support free and open-source software so that it can be audited so that people can actually look at it and know how secure it is.
[48:48.790 --> 48:50.010]  And that's our preference.
[48:50.750 --> 49:00.230]  We have a tech team that's fairly robust that operates from the three offices that we had up on the screen, as well as from a few other locations that delves into this technology.
[49:00.410 --> 49:01.750]  So we are testing it.
[49:02.030 --> 49:07.430]  Drew and I are definitely not testing it, nor would you want us to be, because that would go horribly.
[49:07.430 --> 49:12.050]  But it is something that we are aware of and that we definitely, like I hear about all the time.
[49:12.910 --> 49:30.450]  And my other question was just your thoughts on what the point is or the rationale for these bills that authorize backdoors or clear text data retention, which really, if we were to be honest about it, is merely shedding light on things that the government's already been doing for decades.
[49:30.710 --> 49:32.970]  Like, why are they even bothering to bring it out in the open?
[49:33.150 --> 49:36.890]  Why don't they just keep it behind closed doors and clandestine like they have been?
[49:37.410 --> 49:55.750]  So I think the reason that they're looking for legislation is because even if the NSA has significant capabilities currently where they aren't all that worried about encryption, I would say it's more about law enforcement's access to encrypted technologies where you maybe don't currently have that same level of access.
[49:55.750 --> 50:03.250]  And so, you know, and they'll justify it by saying things like terrorism and child exploitation, that kind of stuff.
[50:03.390 --> 50:05.670]  But, you know, I think that there is still...
[50:05.670 --> 50:10.170]  I wouldn't say that we're at a hopeless place where the government is doing all this stuff already.
[50:10.350 --> 50:14.750]  I think there are still protections that are important that have been valuable.
[50:15.030 --> 50:15.370]  Yeah.
[50:17.330 --> 50:18.910]  So it looks like that's it.
[50:19.590 --> 50:21.290]  So thank you guys for joining.
[50:21.290 --> 50:21.830]  Thank you, everybody.
[50:22.910 --> 50:23.630]  Great questions.
[50:23.790 --> 50:23.970]  Thank you.
[50:24.350 --> 50:25.030]  Thank you.